Audit logs are logged to both disk (audit.xxxx.log, usually in /opt/whdata/log) and to the wrd.auditevents table

The audit disk log files are kept for approximately 3 months. We recommend regularly backing up these logs outside the server

Audit events are kept for 180 days by default. This can be configured in the global archiving settings in the dashboard.